lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 15 Jan 2008 17:02:03 -0600 From: DVLabs <dvlabs@...pingpoint.com> To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Cc: dvlabs@...pingpoint.com Subject: TPTI-08-01: Apple Quicktime Image File IDSC Atom Memory Corruption Vulnerability TPTI-08-01: Apple Quicktime Image File IDSC Atom Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/TPTI-08-01.html January 15, 2008 -- CVE ID: CVE-2008-0033 -- Affected Vendor: Apple -- Affected Products: QuickTime Player 7.3 QuickTime PictureViewer 7.3 -- Vulnerability Details: This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple Quicktime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of malformed Image Descriptor (IDSC) atoms. Specifying a malicious atom size can result in an under allocated heap chunk and subsequently an exploitable heap corruption situation. -- Vendor Response: http://docs.info.apple.com/article.html?artnum=307301 -- Disclosure Timeline: 2007.10.19 - Vulnerability reported to vendor 2008.01.15 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by Cody Pierce - TippingPoint DVLabs.
Powered by blists - more mailing lists